j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(appsettings): the theme must be one of the themes in SASS_DIR

Browse source 
The settings page took the posted theme name as it came and wrote it
into the @import lines of wvc-main.scss and the compiled CSS: a name
with "../" or a quote imported files outside the themes directory
(CodeQL py/path-injection; the page is for superusers).

The name must now be one of the directories in SASS_DIR/wvc-themes, the
list the page already offers; anything else is refused with a message
and nothing is written. themes_list is empty when SASS_DIR has no
themes, so every name is refused then.

Checked with the real dev/scss: flatly is applied and compiled as
before, "../../etc" is refused and leaves the CSS alone. The test fails
on the previous code.
This commit is contained in:
catborise 2026-10-06 08:02:05 +03:00
parent 8383a07ae3
commit d816d8d09f
2 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
appsettings/views.py
View file

@ -20,6 +20,7 @@ def appsettings(request):
main_css = "wvc-main.min.css"
sass_dir = AppSettings.objects.get(key="SASS_DIR")
bootstrap_theme = AppSettings.objects.get(key="BOOTSTRAP_THEME")
themes_list = []
try:
themes_list = os.listdir(sass_dir.value + "/wvc-themes")
except FileNotFoundError as err:
@ -50,6 +51,10 @@ def appsettings(request):
if "BOOTSTRAP_THEME" in request.POST:
theme = request.POST.get("BOOTSTRAP_THEME", "")
# the name goes into @import paths: only the themes in SASS_DIR
if theme not in themes_list:
messages.error(request, _("Unknown theme: %(theme)s") % {"theme": theme})
return HttpResponseRedirect(request.get_full_path())
scss_var = f"@import '{sass_dir.value}/wvc-themes/{theme}/variables';"
# scss_boot = f"@import '{sass_dir.value}/bootstrap/bootstrap.scss';"
scss_boot = f"@import '{sass_dir.value}/bootstrap-overrides.scss';"